QR Imago
Data processing (DPA)
Last updated: October 2026
This document supplements the terms of service and sets out how Yahart, s.r.o. processes personal data on behalf of customers under Article 28 GDPR. It applies to everyone with an account – a family with a memorial as well as a partner who arranges plaques.
Roles
For the content of a memorial the family is the controller and QR Imago the processor: we process the data only on the family's instructions and to the extent needed to run the page. For partners we process their customers' contact details only for the order and the payment of commission.
Subject matter and scope
Data about the deceased and their family, photographs, texts, grave location, visitors' tributes (name, text, optional e-mail) and order data. Processing lasts for the term of the account and package and for one year after they end.
Instructions and confidentiality
We process data solely on your instructions given through the application. Our staff are bound by confidentiality and have access only to what they need to support the service.
Sub-processors
Hosting and database in the European Union, e-mail delivery, the Stripe payment gateway, plaque production and shipping and, for dictated stories, OpenAI for audio transcription. We will send the current list of sub-processors on request; we give 30 days' notice of changes with the right to object.
Security
Encrypted connections (HTTPS), passwords stored as hashes, regular backups, separated access and logging of administrator actions. Only the people you have granted access to can reach the memorial's data.
Personal data breach
If we become aware of a personal data breach, we notify you without undue delay and at the latest within 48 hours, with a description of the incident and the measures taken.
Assistance
We help you handle data subjects' requests (access, rectification, erasure) and provide the information needed to demonstrate compliance, including audits to a reasonable extent.
End of processing
When processing ends we export or delete the data at your request unless the law requires us to keep it (e.g. accounting records). Without instructions we delete it one year after the account is closed.
Requests and questions about data processing: info@qrimago.io.
Yahart, s.r.o. · Hurbanova 586/19, 920 01 Hlohovec · Company ID 50470647 · VAT ID SK2120336416